Migrate from Linux to Win 2008 R2 Server

vk3eka

Hi Guys,

I am migrating OpenVPN from a Linux Server (Centos 5) to Win 2008 R2 Server. I have copied all the certificate files and modified the linux config file to suit windows.

I can connect from the client (Win 7) to the Win 2008 R2 server, but when I try a remote connection to the server (or any other clients) I get a server not accepting remote connections error. The Linux box allowed these connections.

Server config file is:-

port 1194
proto udp
dev tun
dev-node OpenVPN

ca C:\\OpenVPN\\easy-rsa\\keys\\ca.crt
cert C:\\OpenVPN\\easy-rsa\\keys\\server.crt
key C:\\OpenVPN\\easy-rsa\\keys\\server.key
dh C:\\OpenVPN\\easy-rsa\\keys\\dh1024.pem

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt
push "route 192.168.0.0 255.255.255.0"
push "dhcp-option DNS 10.8.0.1"
push "dhcp-option WINS 10.8.0.1"

keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

Any ideas on where I should start looking?

Cheers

Peter

Mimiko

vk3eka wroteI can connect from the client (Win 7) to the Win 2008 R2 server, but when I try a remote connection to the server (or any other clients) I get a server not accepting remote connections error.

What do you mean by remote? Show network structure from server perspective.

Disable firewall on server, or open 1194 udp port.

vk3eka

Mimko,

I have a number of clients that are connected locally to the win 2008 server network. These PC's are accessed via OpenVPN from outside the network (remote desktop connection). I have port 1194 udp open and/or have disabled the firewall (domain, private and public) on the server. The client log shows the connection is made to the server (same log entries as the original Linux box) but no remote desktopping can be made.

Cheers

Peter

Mimiko

Oh, so WIn 2008 have another interface with a public IP or is getting to the inthernet thru some gateway?

So the external clients are conencting to OpenVPN server, its just does not have access to server's LAN's computers.

Show routing table on your Win 2008, show log from external clients and routing table when they are connected to OpenVPN.

vk3eka

Mimko,

The Server has a connection to the Internet through the Domain part of the firewall.

I have a netgear router as the gateway.

The routing table for the server is:-

===========================================================================
Interface List
14...00 ff df 53 d2 e5 ......TAP-Win32 Adapter V9
10...00 25 64 de 66 fe ......Realtek PCIe GBE Family Controller
1...........................Software Loopback Interface 1
11...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
12...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
13...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.4 276
10.8.0.0 255.255.255.0 10.8.0.2 10.8.0.1 30
10.8.0.0 255.255.255.252 On-link 10.8.0.1 286
10.8.0.1 255.255.255.255 On-link 10.8.0.1 286
10.8.0.3 255.255.255.255 On-link 10.8.0.1 286
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.0.0 255.255.255.0 On-link 192.168.0.4 276
192.168.0.4 255.255.255.255 On-link 192.168.0.4 276
192.168.0.255 255.255.255.255 On-link 192.168.0.4 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.0.4 276
224.0.0.0 240.0.0.0 On-link 10.8.0.1 286
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.0.4 276
255.255.255.255 255.255.255.255 On-link 10.8.0.1 286
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 192.168.0.1 Default
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
10 276 fe80::/64 On-link
14 286 fe80::/64 On-link
14 286 fe80::94cb:8e70:957d:392a/128
On-link
10 276 fe80::f4cf:d454:174:122c/128
On-link
1 306 ff00::/8 On-link
10 276 ff00::/8 On-link
14 286 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

The clients log is:-

Sun Aug 28 09:27:04 2011 OpenVPN 2.2.1 Win32-MSVC++ [SSL] [LZO2] built on Jul 1 2011
Sun Aug 28 09:27:04 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sun Aug 28 09:27:04 2011 LZO compression initialized
Sun Aug 28 09:27:04 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Aug 28 09:27:04 2011 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Aug 28 09:27:04 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Aug 28 09:27:04 2011 Local Options hash (VER=V4): '41690919'
Sun Aug 28 09:27:04 2011 Expected Remote Options hash (VER=V4): '530fdded'
Sun Aug 28 09:27:04 2011 UDPv4 link local: [undef]
Sun Aug 28 09:27:04 2011 UDPv4 link remote: 61.9.152.130:1194
Sun Aug 28 09:27:07 2011 TLS: Initial packet from 61.9.152.130:1194, sid=3bc6b590 b1c2c026
Sun Aug 28 09:27:08 2011 VERIFY OK: depth=1, /C=AU/ST=VICTORIA/L=CLIFTONHILL/O=OpenVPN-SAAA/CN=mail.saaa.com/emailAddress=vk3eka@yahoo.com
Sun Aug 28 09:27:08 2011 VERIFY OK: nsCertType=SERVER
Sun Aug 28 09:27:08 2011 VERIFY OK: depth=0, /C=AU/ST=VICTORIA/O=OpenVPN-SAAA/CN=mail.saaa.com/emailAddress=vk3eka@yahoo.com
Sun Aug 28 09:27:09 2011 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Aug 28 09:27:09 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Aug 28 09:27:09 2011 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Aug 28 09:27:09 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Aug 28 09:27:09 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Aug 28 09:27:09 2011 [mail.saaa.com] Peer Connection Initiated with 61.9.152.130:1194
Sun Aug 28 09:27:11 2011 SENT CONTROL [mail.saaa.com]: 'PUSH_REQUEST' (status=1)
Sun Aug 28 09:27:11 2011 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,dhcp-option WINS 192.168.0.1,dhcp-option DNS 192.168.0.1,dhcp-option DOMAIN saaa.local,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9'
Sun Aug 28 09:27:11 2011 OPTIONS IMPORT: timers and/or timeouts modified
Sun Aug 28 09:27:11 2011 OPTIONS IMPORT: --ifconfig/up options modified
Sun Aug 28 09:27:11 2011 OPTIONS IMPORT: route options modified
Sun Aug 28 09:27:11 2011 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Aug 28 09:27:12 2011 ROUTE default_gateway=172.20.10.1
Sun Aug 28 09:27:12 2011 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{A8359DD0-7ABC-4042-8369-FBEE1F055ADA}.tap
Sun Aug 28 09:27:12 2011 TAP-Win32 Driver Version 9.8
Sun Aug 28 09:27:12 2011 TAP-Win32 MTU=1500
Sun Aug 28 09:27:12 2011 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.10/255.255.255.252 on interface {A8359DD0-7ABC-4042-8369-FBEE1F055ADA} [DHCP-serv: 10.8.0.9, lease-time: 31536000]
Sun Aug 28 09:27:12 2011 Successful ARP Flush on interface [16] {A8359DD0-7ABC-4042-8369-FBEE1F055ADA}
Sun Aug 28 09:27:17 2011 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Sun Aug 28 09:27:17 2011 C:\WINDOWS\system32\route.exe ADD 192.168.0.0 MASK 255.255.255.0 10.8.0.9
Sun Aug 28 09:27:17 2011 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Aug 28 09:27:17 2011 Route addition via IPAPI succeeded [adaptive]
Sun Aug 28 09:27:17 2011 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.9
Sun Aug 28 09:27:17 2011 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Aug 28 09:27:17 2011 Route addition via IPAPI succeeded [adaptive]
Sun Aug 28 09:27:17 2011 Initialization Sequence Completed

I can connect to the server from OpenVPN as administrator but cannot connect as client to the client PC's on the LAN.

Thanks for your help.

Cheers

Peter

Mimiko

Are you intendently make things more complicated?
In OpenVPN server's config you have:

push "dhcp-option DNS 10.8.0.1"
push "dhcp-option WINS 10.8.0.1"

But the client get's this:

Sun Aug 28 09:27:11 2011 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,dhcp-option WINS 192.168.0.1,dhcp-option DNS 192.168.0.1,dhcp-option DOMAIN saaa.local,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9'

How WINS and DNS options did change? And from where DOMAIN appeared?

I can connect to the server from OpenVPN as administrator but cannot connect as client to the client PC's on the LAN.

You compare different things. You can connect to the server and cant connect to client. How this is matter with administrator or not?

In Windows, users by default does not have remote access to RDP.

vk3eka

Mimko,

I have changed the config files so now the push dhcp DNS and WINS now point to 10.8.0.1 but still I cannot ping or connect to the remote pc. I presume I need a route between the 10.8 sub net and the 192.168 sub net. I haved added a static route to the Win 2008 R2 server but still not connecting.

The routing table shows:-

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.4 276
10.8.0.0 255.255.255.0 192.168.0.4 10.8.0.1 35
10.8.0.0 255.255.255.0 10.8.0.2 10.8.0.1 31
10.8.0.0 255.255.255.252 On-link 10.8.0.1 286
10.8.0.1 255.255.255.255 On-link 10.8.0.1 286
10.8.0.3 255.255.255.255 On-link 10.8.0.1 286
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.0.0 255.255.255.0 On-link 192.168.0.4 276
192.168.0.4 255.255.255.255 On-link 192.168.0.4 276
192.168.0.255 255.255.255.255 On-link 192.168.0.4 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.0.4 276
224.0.0.0 240.0.0.0 On-link 10.8.0.1 286
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.0.4 276
255.255.255.255 255.255.255.255 On-link 10.8.0.1 286
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 192.168.0.1 Default
===========================================================================

Any ideas?

Peter

Mimiko

You don't need to add a persistent route to the server. It's already there.
Make a tracert from Windows7 to some computer on server's LAN.